---
id: CVE-2026-120830
title: >-
  Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to
  information disclosure
summary: >-
  A flaw was found in libslirp in icmp_forward_error(). When building an ICMP
  error response, the length of the quoted original IPv4 packet was taken from
  the IP header without clamping it to the actual buffer length. A truncated or
  malfor…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: libslirp
affected:
  - libslirp (all versions)
  - 'container-tools:rhel8/libslirp (all versions)'
  - libslirp (all versions)
  - libslirp (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:06:47.499Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120830'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-120830'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2565424'
    label: RHBZ#2565424
  - url: >-
      https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4
tags:
  - cve.org
epss: 0.00221
epssPercentile: 0.12832
ingestedAt: '2026-11-05T21:36:00.633Z'
---

## Overview

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

## Affected

- `libslirp (all versions)`
- `container-tools:rhel8/libslirp (all versions)`
- `libslirp (all versions)`
- `libslirp (all versions)`
- `openshift/ose-rhel-coreos-8 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.

--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to clamp quoted IPv4 payload length to actual buffer bounds in libslirp icmp_forward_error before copying data into ICMP error responses: upgrade to the corresponding fixed Red Hat builds, which clamp s_ip_len to the source buffer length msrc->m_len before copying payload data into the ICMP error packet, closing crafted truncated IPv4 packets with ip_len exceeding mbuf length. Until patched, this is a concern on guests or containers transmitting network traffic through libslirp, so restrict untrusted guests or containers from transmitting network traffic across libslirp virtual network interfaces. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds heap read defect — apply the upstream patch to fully remediate.